JA4 TLS client fingerprint

t13i1515h2_8daaf6152771_02713d6af862

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

2.6K

Ports hit

23.8K

Events

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.19 IPs3.5K

AS9808 China Mobile Communications Group Co., Ltd.15 IPs2.1K

AS202425 IP Volume inc6 IPs154

AS4134 Chinanet4 IPs17.3K

AS11878 tzulo, inc.3 IPs200

AS60068 Datacamp Limited3 IPs175

AS63018 Dedicated.com1 IPs164

AS63473 HostHatch, LLC1 IPs154

AS8075 Microsoft Corporation1 IPs63

AS400587 Ryamer, LLC1 IPs11

AS212238 Datacamp Limited1 IPs10

AS401626 Netiface America, Inc.1 IPs3

Countries

US 28CN 19NL 7CA 3RO 1

Ports targeted

443/tcp 108 1433/tcp 49 3306/tcp 41 27017/tcp 38 3389/tcp 36 9019/tcp 33 8101/tcp 33 10013/tcp 32 9100/tcp 32 2091/tcp 32 4443/tcp 31 2107/tcp 31

What it requests

HEAD/12.1K

GET/favicon.ico11.7K

GET/.env7

GET/.streamlit/secrets.toml3

GET/terraform.tfstate3

GET/.aws/credentials3

GET/serviceAccountKey.json3

GET/x7f9q2z3

GET/.config/gcloud/application_default_credentials.json3

GET/v1/models3

GET/config.json3

GET/docker-compose.yml3

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3649 IPs23.6K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.366 IPs154

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.01 IPs23

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.361 IPs21

Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.11 IPs19

Source IPCCNetwork Last seenEvents

123.160.223.73AS0 Chinanet2026-09-244.4K

123.160.223.74AS0 Chinanet2026-09-244.4K

123.160.223.72AS0 Chinanet2026-09-244.3K

123.160.223.75AS0 Chinanet2026-09-244.2K

47.251.79.205AS0 Alibaba (US) Technology Co., Ltd.2026-09-24204

47.77.228.238AS0 Alibaba (US) Technology Co., Ltd.2026-09-24195

47.88.94.125AS0 Alibaba (US) Technology Co., Ltd.2026-09-24194

47.251.89.134AS0 Alibaba (US) Technology Co., Ltd.2026-09-24193

111.7.96.155AS0 China Mobile Communications Group Co., Ltd.2026-09-24193

47.77.216.189AS0 Alibaba (US) Technology Co., Ltd.2026-09-24192

47.89.246.29AS0 Alibaba (US) Technology Co., Ltd.2026-09-24191

47.251.188.16AS0 Alibaba (US) Technology Co., Ltd.2026-09-24189

47.251.118.89AS0 Alibaba (US) Technology Co., Ltd.2026-09-24188

47.88.18.245AS0 Alibaba (US) Technology Co., Ltd.2026-09-24187

47.89.195.183AS0 Alibaba (US) Technology Co., Ltd.2026-09-24186

47.77.220.146AS0 Alibaba (US) Technology Co., Ltd.2026-09-24184

47.251.88.238AS0 Alibaba (US) Technology Co., Ltd.2026-09-24183

47.251.24.105AS0 Alibaba (US) Technology Co., Ltd.2026-09-24181

47.251.186.126AS0 Alibaba (US) Technology Co., Ltd.2026-09-24180

47.251.188.82AS0 Alibaba (US) Technology Co., Ltd.2026-09-24179

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.